Merge lp:~deryck/launchpad/inline-multicheckbox-xss-741624 into lp:launchpad

[Deryck Hodge]

[r=benji][bug=741624] Remove structure from where InlineMultiCheckboxWidget is initialized.

This removes an unnecessary use of structure in the tal that initializes the InlineMultiCheckboxWidget.

[Deryck Hodge (deryck)]

I welcome anyone's review here, but I'd like to get Ian to look at it since he knows the widget well. Also, I'm fairly confident there isn't an XSS vector here with Ian's earlier released fix, which is why I didn't worry with a private branch and am treating this like a follow-up/clean-up branch.

[Benji York (benji)]

> I welcome anyone's review here, but I'd like to get Ian to look at it since he
> knows the widget well.

The change looks fine. The structure isn't necessary here and the
generated HTML/JavaScript should be the same with or without it.

> Also, I'm fairly confident there isn't an XSS vector here with Ian's
> earlier released fix, which is why I didn't worry with a private
> branch and am treating this like a follow-up/clean-up branch.

Right, since the string is a constant there is no XSS vulnerability.

review: Approve (code)

=== modified file 'lib/lp/app/templates/inline-multicheckbox-widget.pt'
--- lib/lp/app/templates/inline-multicheckbox-widget.pt	2011-04-11 04:45:38 +0000
+++ lib/lp/app/templates/inline-multicheckbox-widget.pt	2011-04-25 18:44:32 +0000
@@ -30,7 +30,7 @@
   <div class="yui3-activator-message-box yui3-activator-hidden"/>
 </span>
 <script tal:condition="view/can_write"
-        tal:content="structure string:
+        tal:content="string:
 LPS.use('lp.app.multicheckbox', function(Y) {
     if (Y.UA.ie) {
         return;